CVE-2026-7086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7086", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T08:16:28.410Z", "datePublished": "2026-04-27T04:15:12.103Z", "dateUpdated": "2026-04-27T11:22:34.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T04:15:12.103Z"}, "title": "HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "HBAI-Ltd", "product": "Toonflow-app", "versions": [{"version": "1.1.0", "status": "affected"}, {"version": "1.1.1", "status": "affected"}], "modules": ["Storyboard Export"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl of the file replaceUrl.ts of the component Storyboard Export. Such manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is still unclear if this vulnerability genuinely exists. The vendor explains in a reply to the issue report, that \"[t]he URL of this interface is designed to only be a local address or a trusted domain address configured in docker, and will not contain malicious links, unless the user modifies the code causing unexpected situations.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T10:21:42.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yu-Bao (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359661", "name": "VDB-359661 | HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359661/cti", "name": "VDB-359661 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799584", "name": "Submit #799584 | HBAI-Ltd Toonflow 1.1.1 Path Traversal Leading to Arbitrary File Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/97", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/97#issuecomment-4208207717", "tags": ["issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/", "tags": ["product"]}], "tags": ["disputed"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T11:13:46.841795Z", "id": "CVE-2026-7086", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T11:22:34.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7086", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T11:13:46.841795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T11:22:31.446Z"}}], "cna": {"tags": ["disputed"], "title": "HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Yu-Bao (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C"}}], "affected": [{"vendor": "HBAI-Ltd", "modules": ["Storyboard Export"], "product": "Toonflow-app", "versions": [{"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.1.1"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T10:21:42.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359661", "name": "VDB-359661 | HBAI-Ltd Toonflow-app Storyboard Export replaceUrl.ts updateStoryboardUrl path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359661/cti", "name": "VDB-359661 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799584", "name": "Submit #799584 | HBAI-Ltd Toonflow 1.1.1 Path Traversal Leading to Arbitrary File Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/97", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/97#issuecomment-4208207717", "tags": ["issue-tracking"]}, {"url": "https://github.com/HBAI-Ltd/Toonflow-app/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl of the file replaceUrl.ts of the component Storyboard Export. Such manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is still unclear if this vulnerability genuinely exists. The vendor explains in a reply to the issue report, that \"[t]he URL of this interface is designed to only be a local address or a trusted domain address configured in docker, and will not contain malicious links, unless the user modifies the code causing unexpected situations.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T04:15:12.103Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7086", "state": "PUBLISHED", "dateUpdated": "2026-04-27T11:22:34.836Z", "dateReserved": "2026-04-26T08:16:28.410Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-27T04:15:12.103Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Storyboard Export"], "product": "Toonflow-app", "vendor": "HBAI-Ltd", "versions": [{"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.1.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [{"sourceIdentifier": "cna@vuldb.com", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function updateStoryboardUrl of the file replaceUrl.ts of the component Storyboard Export. Such manipulation of the argument url leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. It is still unclear if this vulnerability genuinely exists. The vendor explains in a reply to the issue report, that \"[t]he URL of this interface is designed to only be a local address or a trusted domain address configured in docker, and will not contain malicious links, unless the user modifies the code causing unexpected situations.\""}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en la aplicaci\u00f3n HBAI-Ltd Toonflow hasta la versi\u00f3n 1.1.1. Este problema afecta a la funci\u00f3n updateStoryboardUrl del archivo replaceUrl.ts del componente Storyboard Export. Dicha manipulaci\u00f3n del argumento url conduce a un salto de ruta. Es posible lanzar el ataque de forma remota. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. A\u00fan no est\u00e1 claro si esta vulnerabilidad realmente existe. El proveedor explica en una respuesta al informe del problema, que \u2019La URL de esta interfaz est\u00e1 dise\u00f1ada para ser solo una direcci\u00f3n local o una direcci\u00f3n de dominio de confianza configurada en docker, y no contendr\u00e1 enlaces maliciosos, a menos que el usuario modifique el c\u00f3digo causando situaciones inesperadas.\u2019"}], "id": "CVE-2026-7086", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7086", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T11:13:46.841795Z", "version": "2.0.3"}}]}, "published": "2026-04-27T06:16:03.223", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/HBAI-Ltd/Toonflow-app/"}, {"source": "cna@vuldb.com", "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/97"}, {"source": "cna@vuldb.com", "url": "https://github.com/HBAI-Ltd/Toonflow-app/issues/97#issuecomment-4208207717"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/799584"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359661"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359661/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Toonflow-app", "source": "cna", "vendor": "HBAI-Ltd"}, "product": "toonflow-app", "vendor": "hbai-ltd"}], "analysis": {"en": {"generated_at": "2026-04-28T04:50:12.138142+00:00", "value": {"mitigation_remediation": ["Restrict the updateStoryboardUrl endpoint to trusted internal networks or localhost only, blocking remote access from untrusted clients.", "Implement strict input validation or a whitelist that accepts only local or docker\u2011configured domain URLs before the function processes them.", "If the endpoint is not required in your deployment, disable or remove it entirely."], "summary": {"action": "Mitigate", "impact": "Remote Path Traversal via updateStoryboardUrl"}, "threat_synthesis": {"affected_systems": "HBAI\u2011Ltd Toonflow\u2011app versions up to 1.1.1 are affected. No other versions or products are specifically listed.", "description_and_impact": "The updateStoryboardUrl function in replaceUrl.ts allows manipulation of the url argument, leading to a path traversal vulnerability that could expose or alter files outside the intended directory. This flaw can be triggered remotely by supplying crafted URLs, and a publicly available exploit exists, though the vendor notes uncertainty about its efficacy in production. The interface is intended to receive only local or docker\u2011configured addresses, so the risk is highest if the code is modified or the endpoint is exposed to untrusted input.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. EPSS shows an exploitation probability below 1%, and the vulnerability is not listed in CISA KEV, suggesting limited widespread exploitation. The attack vector is remotely accessible via the exposed updateStoryboardUrl endpoint; an attacker can use unsanitized URLs to read or write arbitrary files, potentially compromising confidentiality or enabling further attacks if the application runs with elevated privileges."}}}}, "created": "2026-04-27T19:51:41.374609+00:00", "updated": "2026-04-28T05:00:14.733129+00:00", "vendors": ["hbai-ltd", "hbai-ltd$PRODUCT$toonflow-app"], "weaknesses": ["CWE-22"]}